Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jinning6/noosphere/windows-npm-run-script-shellnpx skills add JinNing6/Noosphere --skill windows-npm-run-script-shellgit clone --depth 1 https://github.com/JinNing6/NoosphereWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jinning6/noosphere/windows-npm-run-script-shell)<a href="https://agentmods.dev/skills/jinning6/noosphere/windows-npm-run-script-shell"><img src="https://agentmods.dev/badge/skills/jinning6/noosphere/windows-npm-run-script-shell.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.00710 |
| Opus 5 | $0.00035 | $0.00355 |
| Sonnet 5 | $0.00014 | $0.00142 |
| Haiku 4.5 | $0.00007 | $0.00071 |
Grade A, and why
windows-npm-run-script-shell scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Windows Npm Run Script Shell
Overview
Windows npm scripts need a shell. If ComSpec is missing or npm cannot infer a script shell, npm run ... can fail inside npm before tsc, Vite, Vitest, or Playwright actually runs.
Triage
Use this flow before changing app code:
- Run the target tool directly with
npx, for examplenpx tsc -b --pretty false,npx vite build, ornpx vitest run. - Run
npm run <script> --loglevel verbose. - Open the npm debug log if output is empty.
- Check shell config:
npm config get script-shell
npm config get cache
npm config get update-notifier
Write-Host "ComSpec=[$env:ComSpec]"
Write-Host "SHELL=[$env:SHELL]"
If direct npx commands pass but npm run fails with ERR_INVALID_ARG_TYPE: The "file" argument must be of type string. Received undefined, treat it as npm shell configuration, not a project build failure.
If direct node <script> succeeds but npm test/npm run exits silently in a sandbox, rerun with --loglevel verbose. When npm reports EPERM creating %LocalAppData%\npm-cache\_logs or attempts registry access only for update checks, treat it as npm runtime side effects, not a test failure.
Fix
Prefer a project-local .npmrc so the fix travels with the repo:
script-shell=C:\Windows\System32\cmd.exe
For sandboxed Windows workspaces where npm cannot write the user cache/log directory, keep npm side effects inside the repo and disable network-prone notices:
cache=.npm-cache
update-notifier=false
fund=false
audit=false
script-shell=cmd.exe
Then rerun:
npm run build
npm test -- --run
If the project requires PowerShell syntax in scripts, set script-shell to PowerShell and avoid && in package scripts, because Windows PowerShell 5 does not support &&.
Common Mistakes
- Do not rewrite TypeScript, Vite, Vitest, or React code when
npx <tool>succeeds and onlynpm runfails. - Do not treat silent npm output as proof that the build tool produced no diagnostics; inspect the npm debug log.
- Do not ignore npm cache/log
EPERMin sandboxed workspaces; set a project-local cache before escalating. - Do not set a global npm config unless the user asked for machine-wide changes.
- Do not assume
SHELLreplacesComSpecfor npm on Windows.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 75 lines · 70 tokens per session scan A 7af3dc0b48d2
windows-npm-run-script-shell is a skill published in the GitHub repository JinNing6/Noosphere (18 stars, last pushed 4d ago), licensed Apache-2.0. It adds 70 tokens to every session and 710 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prjct
The agentic harness for AI coding agents: machine-verified ships, guarded edits, and project lookup that beats re-deriving from source. Run the prjct verb yourself; use prjct work normally.
memstate-ai
Persistent, versioned memory for AI agents via Memstate AI. Alternative to the Memstate MCP plugin — use for storing facts, recalling memory, managing projects, and semantic search of agent summaries. Supports Markdown ingestion and direct keypath = value assignment. Requires MEMSTATEAPIKEY.
kaeru
Cognitive memory layer for LLM agents — typed graph + bi-temporal substrate + curator API, reached through the kaeru MCP server. Use when the user wants to capture, recall, reason, or trace persistent thoughts across sessions; when re-entering a multi-session project; or when the user explicitly asks to "remember"…
writing
将共享历史中的已验证事实和计算结果整理成符合受众、格式与长度约束的成稿。.
kayba-stage-7-fixer
Implement the approved fixes from the action plan and log all changes. Trigger when the user says "run stage 7", "implement fixes", "apply action plan", or when invoked by the kayba-pipeline orchestrator. Requires eval/actionplan.md to exist.
food-order
Reorder previous Foodora orders, preview cart contents, and track delivery ETA/status with ordercli. Use when the user wants to reorder food, check delivery status, or browse recent Foodora order history. Never confirm an order without explicit user approval.